ColdFusion on IIS cfm/dbm Diagnostic Error Path Disclosure

It was possible to make the remote web server disclose the physical path to its web root by requesting a MS-DOS device ending in .dbm as in nul.dbm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was written by Renaud Deraison Modified by Paul Johnston for Westpoint Ltd to displ...

Sun JDK/SDK 1.3/1.4 / IBM JDK 1.3.1 / BEA Systems WebLogic 5/6/7 - java.util.zip Null Value Denial of Service (1)

source: https://www.securityfocus.com/bid/7109/info Several implementations of the Java Virtual Machine have been reported to be prone to a denial of service condition. This vulnerability occurs in several methods in the java.util.zip class. The methods can be called with certain types of...

CVE-2002-1992

Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote attackers to cause a denial of service in IIS via 1 a long template file name or 2 a long HTTP header...

CVE-2002-1700

Cross-site scripting vulnerability XSS in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message...

Macromedia ColdFusion crossite scripting

Crossite scripting in error message...

Cross-site scripting vulnerability in CF 5.0

Cross-site scripting vulnerability in CF 5.0. This issue was brought up to macromedia on July 22nd, 2002. Macromedia issued a fix to me, but I have not seen the fix available to the public. the coldfusion administrator allows you to view your application log via your web browser. Under certain...

CVE-2002-1309

Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary via an HTTP GET request with a long .cfm file name...

CVE-2002-1309

The vulnerability CVE-2002-1309 is a heap-based buffer overflow in the error-handling path of the IIS ISAPI handler for Macromedia ColdFusion 6.0. An unauthenticated remote attacker could trigger arbitrary code execution by sending an HTTP GET request with a long .cfm filename. The description an...

CVE-2002-1309

Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary via an HTTP GET request with a long .cfm file name...

Macromedia JRun/ColdFusion buffer overflow

Multiple buffer overlfows during URI parsing...

ColdFusion Heap Overflow -continued

Hi all, I am attempting to write exploit code for the coldfusion heap overflow still. On advice from various on the secfocus list i have installed softice and located the exception handler in question. The handler code starts at 0x77f82b95 The code I am trying to manipulate is at 0x77f8e43b Mov...

EEYE: Macromedia ColdFusion/JRun Remote SYSTEM Buffer Overflow Vulnerabilities

Macromedia ColdFusion/JRun Remote SYSTEM Buffer Overflow Vulnerabilities Release Date: November 12, 2002 Severity: High Remote SYSTEM level code execution Systems Affected: Macromedia Coldfusion 6.0 and prior IIS ISAPI Macromedia JRun 4.0 and prior IIS ISAPI Description: Macromedia JRun and...

CVE-2002-0576

ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message...

ColdFusion MX - Missing Template Cross-Site Scripting

ColdFusion MX - Missing Template Cross-Site Scripting source: https://www.securityfocus.com/bid/5011/info ColdFusion MX is prone to cross site scripting attacks. Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of...

ColdFusion MX - Missing Template Cross-Site Scripting

source: https://www.securityfocus.com/bid/5011/info ColdFusion MX is prone to cross site scripting attacks. Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of ColdFusion. The attacker-supplied script code will be...

Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure

Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure source: https://www.securityfocus.com/bid/4882/info Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program tha...

Gafware CFXImage 1.6.4/1.6.6 - ShowTemp File Disclosure

source: https://www.securityfocus.com/bid/4882/info Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program that allows a malicious user to read files outside of the...

Physical path leakage in ColdFusion

Error message on access attempt to DOS device contains physical path...

KPMG-2002013: Coldfusion Path Disclosure

-------------------------------------------------------------------- Title: Coldfusion Path Disclosure BUG-ID: 2002013 Released: 18th Apr 2002 -------------------------------------------------------------------- Problem: ======== Requests for certain DOS-devices are parsed by the isapi filter tha...

CVE-2001-1120

CVE-2001-1120 affects Allaire/Macromedia ColdFusion Server (versions 2.0–4.5.1 SP2). The issue allows remote attackers to read or delete arbitrary files or overwrite ColdFusion server templates via network access. The vulnerability is documented across multiple sources (NVD, CVE list, CERT/CC) wi...